Systemic Risks in Managed PostgreSQL Exploiting PostGIS addr...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://mehmetince.net/part-1-6-systemic-risks-in-the-managed-postgresql-industry-extension-risks-are-real-exploiting-postgis-memory-corruption-bug-at-neondb-supabase-and-many-more
• Blog Title: Systemic Risks in Managed PostgreSQL: Exploiting PostGIS address_standardizer Memory Corruption
• Suggested Section: Network Services Pentesting > 5432,5433 - Pentesting PostgreSQL > Native Extension Security and PostGIS address_standardizer Memory Corruption

🎯 Content Summary

Overview

The article analyzes CVE-2026-73514, a missing bounds check in PostGIS's native address_standardizer PostgreSQL extension. A database user able to invoke standardize_address() can select a custom rules table and place attacker-controlled integers in the rule's Type and Weight fields. The extension validates input and output token symbols but, in the vulnerable code, does not enforce minimum or maximum values...

🔧 Technical Details

Trace caller-selected database objects into native extension code: When a native database extension allows the caller to select a lookup, configuration, grammar, or rules table, every value fetched from that table must be treated as attacker-controlled native input. Follow the complete SQL-to-C path and identify values reaching array indices, offsets, lengths, allocation sizes, enum-like selectors, object fields, or pointer operations. In this case, the path was standardize_address() -> load_rules() -> parse_rule() -> rules_add_rule() -> classify_link(), and the final Type and Weight integers reached C code without bounds validation.

Convert an unchecked enum-like value into relative OOB access: A field intended to represent one of a small number of classes becomes a memory-corruption primitive if used directly as an array index. For an array of five pointers, valid values are 0..4🤖 Agent Actions

Updated src/binary-exploitation/array-indexing.md with:

• Read-dependent constrained OOB-write patterns.
• NULL and non-NULL linked-list corruption branches.
• Exploitation constraints and ASLR considerations.
• A concise PostGIS address_standardizer example and crash probe.
• Proper numbered citation to the original research.

Validation passed with git diff --check; only this file was modified, and no forbidden sources were added.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://mehmetince.net/part-1-6-systemic-risks-in-the-managed-postgresql-industry-extension-risks-are-real-exploiting-postgis-memory-corruption-bug-at-neondb-supabase-and-many-more

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting > 5432,5433 - Pentesting PostgreSQL > Native Extension Security and PostGIS address_standardizer Memory Corruption".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0